Support MCP 2026-07-28 and preserve outbound connection errors

[austinm911]

Fix outbound MCP clients failing against stateless 2026-07-28 servers. The legacy client initialized a session, then failed when the next request reached another server runtime. Its SSE fallback could hide the original HTTP failure.

Move authored apps and generated templates to @modelcontextprotocol/client and @modelcontextprotocol/core 2.0.0. HTTP negotiates modern or legacy protocol, legacy SSE remains available, and stdio retains legacy initialization. Tool calls carry their known definition so the new SDK does not introduce catalog fetches or automatic tool retries. Interrupted discovery closes the transport even before the SDK owns it.

Preserve the primary connection failure and sanitized fallback status or timeout, including whether legacy initialization had succeeded. Add compatible optional diagnostics to current host protocol 11. Released protocols 1–10 remain unchanged. Keep v2's MCP health checks, upstream JSON-RPC errors, session reporting, account-secret redaction, and telemetry ownership. Bump apps to 0.0.1-beta.66. Existing deployed apps retain their bundled client until rebuilt.

Framework fixture dependencies derive from shared release metadata. Standalone legacy SDK fixtures use the suite's own SDK dependency. Package and authoring-document checks validate both SDK 2 peer versions.

Validation after resolving conflicts against v2 cc1da8a03:

• bun run check passed, including protocol compatibility, dependency patches, lint, typechecks, generated skill documents, and E2E boundary checks.
• bun run --cwd packages/apps test:package passed for all 19 imports and strict NodeNext/Bundler consumers without optional peers.
• Five focused self-host E2E scenarios passed: modern discovery/calls across independent runtimes, primary/fallback refusal diagnostics, account health, quick-add manifests, and NodeNext package imports.
• Previous conflict update passed 14 distinct focused self-host scenarios, including modern elicitation, legacy HTTP/SSE, interrupted negotiation cleanup, fallback timeouts, lost initialized sessions, and upstream JSON-RPC errors.
• Original regression proof: the pre-fix client failed the modern discovery and refused-connection assertions; the fixed client passed them.

Cloud deployment and live stdio subprocess behavior were not exercised. No deployment or package publication is included.

Closes #2187.

all